North Korean Hackers Deploy Medusa Ransomware in U.S. Healthcare Attacks A joint investigation by Symantec and the Carbon Black Threat Hunter Team has revealed that North Korean state-sponsored hackers, specifically the Lazarus Group, are targeting U.S. healthcare organizations and non-profits with Medusa ransomware. The attacks, linked to the Reconnaissance General Bureau (RGB) of North Korea’s government, blend espionage with financially motivated cybercrime. Medusa, a ransomware-as-a-service (RaaS) operation active since 2023, operates under a double-extortion model encrypting data and threatening to leak or auction stolen information if ransoms go unpaid. While Lazarus has previously used Maui and Play ransomware, recent evidence confirms its shift to Medusa in campaigns since November 2025. Victims include a non-profit mental health provider and an educational facility for autistic children, with average ransom demands reaching $260,000. A Lazarus subgroup, Stonefly (aka Andariel), is suspected of involvement. The group, historically focused on espionage, has increasingly turned to ransomware attacks on healthcare targets over the past five years. The U.S. Department of Justice has indicted Rim Jong Hyok, a North Korean national allegedly tied to the RGB, for his role in these attacks, which are believed to fund broader espionage operations. Symantec and Carbon Black have tracked 366 Medusa ransomware attacks, though the group claims over 500 victims, including more than 40 healthcare organizations. Indicators of compromise (IoCs) and tools used in the campaigns have been shared to aid detection. While attribution to a specific Lazarus subgroup remains unclear, the evidence firmly ties the attacks to the broader Lazarus collective.